cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/roles/cloudfall_bootstrap/tasks/main.yml

@@ -0,0 +1,99 @@
+---
+- name: Validate bootstrap target
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+    fail_msg: Cloudfall bootstrap supports Debian hosts running systemd only
+
+- name: Install baseline operating-system packages
+  ansible.builtin.apt:
+    name: "{{ cloudfall_bootstrap_packages }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Create application root
+  ansible.builtin.file:
+    path: "{{ cloudfall_bootstrap_apps_root }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Create application groups
+  ansible.builtin.group:
+    name: "{{ item.user }}"
+    state: present
+    system: true
+  loop: "{{ cloudfall_bootstrap_applications }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Create application service accounts
+  ansible.builtin.user:
+    name: "{{ item.user }}"
+    group: "{{ item.user }}"
+    home: "{{ cloudfall_bootstrap_apps_root }}/{{ item.id }}"
+    shell: /usr/sbin/nologin
+    create_home: false
+    system: true
+    state: present
+  loop: "{{ cloudfall_bootstrap_applications }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Create application roots
+  ansible.builtin.file:
+    path: "{{ cloudfall_bootstrap_apps_root }}/{{ item.id }}"
+    state: directory
+    owner: "{{ item.user }}"
+    group: "{{ item.user }}"
+    mode: "0750"
+  loop: "{{ cloudfall_bootstrap_applications }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Create application shared directories
+  ansible.builtin.file:
+    path: "{{ cloudfall_bootstrap_apps_root }}/{{ item.id }}/shared"
+    state: directory
+    owner: "{{ item.user }}"
+    group: "{{ item.user }}"
+    mode: "0750"
+  loop: "{{ cloudfall_bootstrap_applications }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Create component roots
+  ansible.builtin.file:
+    path: "{{ item.install_root }}"
+    state: directory
+    owner: "{{ item.application_user }}"
+    group: "{{ item.application_user }}"
+    mode: "0750"
+  loop: "{{ cloudfall_bootstrap_components }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Create component release directories
+  ansible.builtin.file:
+    path: "{{ item.install_root }}/releases"
+    state: directory
+    owner: "{{ item.application_user }}"
+    group: "{{ item.application_user }}"
+    mode: "0750"
+  loop: "{{ cloudfall_bootstrap_components }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Create component shared directories
+  ansible.builtin.file:
+    path: "{{ item.install_root }}/shared"
+    state: directory
+    owner: "{{ item.application_user }}"
+    group: "{{ item.application_user }}"
+    mode: "0750"
+  loop: "{{ cloudfall_bootstrap_components }}"
+  loop_control:
+    label: "{{ item.id }}"

cloudfall_engine/_bundled/ansible/roles/cloudfall_data_migration/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+cloudfall_data_migration_receipt_directory: ""
+cloudfall_data_migration_url_path: /root/.cloudfall-data-source-url
+cloudfall_data_migration_dump_path: /var/tmp/cloudfall-data-migration.dump
+# Exact per-table row counts in one deterministic query, so source and
+# target evidence can be compared verbatim.
+cloudfall_data_migration_count_query: >-
+  SELECT table_name,
+         (xpath('/row/c/text()',
+                query_to_xml(format('SELECT count(*) AS c FROM %I.%I',
+                                    table_schema, table_name),
+                             false, true, '')))[1]::text::bigint AS rows
+  FROM information_schema.tables
+  WHERE table_schema = 'public' AND table_type = 'BASE TABLE'
+  ORDER BY table_name

cloudfall_engine/_bundled/ansible/roles/cloudfall_data_migration/meta/argument_specs.yml

@@ -0,0 +1,36 @@
+---
+argument_specs:
+  main:
+    short_description: Migrate one external PostgreSQL database into a declared service
+    options:
+      cloudfall_data_migration_service:
+        type: dict
+        required: true
+        description: The rendered declared PostgreSQL service receiving the data
+      cloudfall_data_migration_database:
+        type: str
+        required: true
+        description: Declared database name inside the service to restore into
+      cloudfall_data_migration_source_url_file:
+        type: path
+        required: true
+        description: >-
+          Controller-side file whose only content is the source database
+          connection URL; the URL itself never crosses a command line
+      cloudfall_data_migration_receipt_directory:
+        type: str
+        required: false
+        default: ""
+        description: Controller directory receiving the migration receipt
+      cloudfall_data_migration_url_path:
+        type: path
+        required: false
+        default: /root/.cloudfall-data-source-url
+      cloudfall_data_migration_dump_path:
+        type: path
+        required: false
+        default: /var/tmp/cloudfall-data-migration.dump
+      cloudfall_data_migration_count_query:
+        type: str
+        required: false
+        description: Deterministic per-table row-count query used on both sides

cloudfall_engine/_bundled/ansible/roles/cloudfall_data_migration/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_data_migration
+  author: Cloudfall
+  description: Dump an external PostgreSQL database and restore it locally with verification
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_data_migration/tasks/main.yml

@@ -0,0 +1,201 @@
+---
+- name: Validate the migration target service
+  ansible.builtin.assert:
+    that:
+      - cloudfall_data_migration_service.serviceKind == "postgresql"
+    fail_msg: Data migration supports declared PostgreSQL services only
+
+- name: Select the declared target database
+  ansible.builtin.set_fact:
+    cloudfall_data_migration_entries: >-
+      {{
+        cloudfall_data_migration_service.postgresql.databases
+        | selectattr('name', 'equalto', cloudfall_data_migration_database)
+        | list
+      }}
+
+- name: Require exactly one declared database entry
+  ansible.builtin.assert:
+    that:
+      - cloudfall_data_migration_entries | length == 1
+    fail_msg: >-
+      Database {{ cloudfall_data_migration_database }} is not declared on
+      service {{ cloudfall_data_migration_service.id }}; declare it in the
+      config before migrating data into it
+
+- name: Record the declared database owner
+  ansible.builtin.set_fact:
+    cloudfall_data_migration_owner: >-
+      {{ cloudfall_data_migration_entries[0].owner }}
+
+- name: Migrate and verify the declared database
+  block:
+    - name: Stage the source connection URL on the target host
+      ansible.builtin.copy:
+        src: "{{ cloudfall_data_migration_source_url_file }}"
+        dest: "{{ cloudfall_data_migration_url_path }}"
+        owner: root
+        group: root
+        mode: "0600"
+      no_log: true
+
+    - name: Count existing tables in the target database
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/psql
+          - --dbname
+          - "{{ cloudfall_data_migration_database }}"
+          - --tuples-only
+          - --no-align
+          - --command
+          - >-
+            SELECT count(*) FROM information_schema.tables
+            WHERE table_schema = 'public'
+      become: true
+      become_user: postgres
+      register: cloudfall_data_migration_target_tables
+      changed_when: false
+
+    - name: Refuse to restore into a non-empty database
+      ansible.builtin.assert:
+        that:
+          - cloudfall_data_migration_target_tables.stdout | trim == "0"
+        fail_msg: >-
+          Database {{ cloudfall_data_migration_database }} already contains
+          {{ cloudfall_data_migration_target_tables.stdout | trim }}
+          tables; data migration refuses to overwrite existing data
+
+    - name: Dump the source database on the target host
+      ansible.builtin.shell:
+        cmd: >-
+          pg_dump
+          --dbname "$(cat {{ cloudfall_data_migration_url_path | quote }})"
+          --no-owner --no-privileges --format custom
+          --file {{ cloudfall_data_migration_dump_path | quote }}
+      register: cloudfall_data_migration_dump
+      retries: 3
+      delay: 10
+      until: cloudfall_data_migration_dump.rc == 0
+      changed_when: true
+
+    - name: Restrict the staged dump to the postgres user
+      ansible.builtin.file:
+        path: "{{ cloudfall_data_migration_dump_path }}"
+        owner: postgres
+        group: postgres
+        mode: "0600"
+
+    - name: Read source table row counts
+      ansible.builtin.shell:
+        cmd: >-
+          psql
+          --dbname "$(cat {{ cloudfall_data_migration_url_path | quote }})"
+          --csv --tuples-only
+          --command {{ cloudfall_data_migration_count_query | quote }}
+      register: cloudfall_data_migration_source_counts
+      changed_when: false
+
+    - name: Require at least one source table
+      ansible.builtin.assert:
+        that:
+          - cloudfall_data_migration_source_counts.stdout_lines | length > 0
+        fail_msg: >-
+          The source database contains no tables in schema public; there is
+          nothing to migrate
+
+    - name: Restore the dump into the declared database
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/pg_restore
+          - --no-owner
+          - --no-privileges
+          - --role
+          - "{{ cloudfall_data_migration_owner }}"
+          - --dbname
+          - "{{ cloudfall_data_migration_database }}"
+          - "{{ cloudfall_data_migration_dump_path }}"
+      become: true
+      become_user: postgres
+      changed_when: true
+
+    - name: Read restored table row counts
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/psql
+          - --dbname
+          - "{{ cloudfall_data_migration_database }}"
+          - --csv
+          - --tuples-only
+          - --command
+          - "{{ cloudfall_data_migration_count_query }}"
+      become: true
+      become_user: postgres
+      register: cloudfall_data_migration_restored_counts
+      changed_when: false
+
+    - name: Require identical per-table row counts
+      ansible.builtin.assert:
+        that:
+          - >-
+            cloudfall_data_migration_source_counts.stdout_lines
+            == cloudfall_data_migration_restored_counts.stdout_lines
+        fail_msg: >-
+          Restored row counts do not match the source; source
+          {{ cloudfall_data_migration_source_counts.stdout_lines }}
+          versus restored
+          {{ cloudfall_data_migration_restored_counts.stdout_lines }}
+  always:
+    - name: Remove the staged source connection URL
+      ansible.builtin.file:
+        path: "{{ cloudfall_data_migration_url_path }}"
+        state: absent
+
+    - name: Remove the staged dump
+      ansible.builtin.file:
+        path: "{{ cloudfall_data_migration_dump_path }}"
+        state: absent
+
+- name: Ensure the controller receipt directory exists
+  ansible.builtin.file:
+    path: "{{ cloudfall_data_migration_receipt_directory }}"
+    state: directory
+    mode: "0755"
+  delegate_to: localhost
+  become: false
+  when: cloudfall_data_migration_receipt_directory | length > 0
+
+- name: Write the data-migration receipt on the controller
+  ansible.builtin.copy:
+    content: >-
+      {{
+        {
+          'apiVersion': 'cloudfall/v1',
+          'kind': 'DataMigrationReceipt',
+          'metadata': {
+            'id': cloudfall_data_migration_service.id
+              ~ '-' ~ cloudfall_data_migration_database,
+            'description':
+              'Data-migration receipt written by cloudfall_data_migration',
+          },
+          'spec': {
+            'service': cloudfall_data_migration_service.id,
+            'database': cloudfall_data_migration_database,
+            'owner': cloudfall_data_migration_owner,
+            'server': cloudfall_server_id,
+            'migratedAt': ansible_facts['date_time']['iso8601'],
+            'tables': cloudfall_data_migration_source_counts.stdout_lines
+              | map('regex_replace', '^(.*),([0-9]+)$',
+                    '{"table": "\1", "rows": \2}')
+              | map('from_json') | list,
+            'verification': 'per-table row counts matched',
+          },
+        } | to_nice_json
+      }}
+    dest: >-
+      {{ cloudfall_data_migration_receipt_directory }}/{{
+        cloudfall_data_migration_service.id
+      }}-{{ cloudfall_data_migration_database }}.json
+    mode: "0644"
+  delegate_to: localhost
+  become: false
+  when: cloudfall_data_migration_receipt_directory | length > 0

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/defaults/main.yml

@@ -0,0 +1,10 @@
+---
+cloudfall_deploy_environment_file: ""
+cloudfall_deploy_receipt_directory: ""
+cloudfall_deploy_uv_version: "0.12.10"
+cloudfall_deploy_uv_sha256: >-
+  173d95a0c32d18c896c46ba6fafbf3cf9c14ab74b033f81b76c883ef492a976b
+cloudfall_deploy_uv_url: >-
+  https://github.com/astral-sh/uv/releases/download/{{
+    cloudfall_deploy_uv_version
+  }}/uv-x86_64-unknown-linux-gnu.tar.gz

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/meta/argument_specs.yml

@@ -0,0 +1,125 @@
+---
+argument_specs:
+  main:
+    short_description: Deploy one verified release of a declared component
+    options:
+      cloudfall_deploy_component:
+        type: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          application:
+            type: str
+            required: true
+          application_user:
+            type: str
+            required: true
+          install_root:
+            type: path
+            required: true
+          repository:
+            type: dict
+            required: true
+          runtime:
+            type: dict
+            required: true
+            options:
+              type:
+                type: str
+                required: true
+              version:
+                type: str
+                required: true
+              packageManager:
+                type: str
+                required: true
+          service:
+            type: dict
+            required: true
+            options:
+              manager:
+                type: str
+                choices:
+                  - systemd
+                required: true
+              name:
+                type: str
+                required: true
+              command:
+                type: list
+                elements: str
+                required: true
+          healthCheck:
+            type: dict
+            required: true
+            options:
+              type:
+                type: str
+                choices:
+                  - http
+                  - none
+                required: true
+              scheme:
+                type: str
+                choices:
+                  - http
+                  - https
+              port:
+                type: int
+              path:
+                type: str
+              expectedStatuses:
+                type: list
+                elements: int
+              timeoutSeconds:
+                type: int
+              attempts:
+                type: int
+          retainUntilCleanup:
+            type: bool
+            required: true
+      cloudfall_deploy_release:
+        type: str
+        required: true
+      cloudfall_deploy_artifact_archive:
+        type: str
+        required: true
+      cloudfall_deploy_artifact_sha256:
+        type: str
+        required: true
+      cloudfall_deploy_environment_file:
+        type: str
+        default: ""
+      cloudfall_deploy_receipt_directory:
+        type: str
+        default: ""
+      cloudfall_deploy_uv_version:
+        type: str
+        default: "0.12.10"
+      cloudfall_deploy_uv_sha256:
+        type: str
+      cloudfall_deploy_uv_url:
+        type: str
+  rollback:
+    short_description: Roll one component back to an existing release
+    options:
+      cloudfall_deploy_component:
+        type: dict
+        required: true
+      cloudfall_deploy_release:
+        type: str
+        required: true
+  restart:
+    short_description: Restart one component behind its health check
+    options:
+      cloudfall_deploy_component:
+        type: dict
+        required: true
+  health:
+    short_description: Probe one component's declared health check
+    options:
+      cloudfall_deploy_component:
+        type: dict
+        required: true

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_deploy
+  author: Cloudfall
+  description: Deploy one verified component release with a health-gated switch
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/tasks/health.yml

@@ -0,0 +1,3 @@
+---
+- name: Probe the component's declared health check
+  ansible.builtin.include_tasks: health_gate.yml

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/tasks/health_gate.yml

@@ -0,0 +1,37 @@
+---
+- name: Gate the component on its declared HTTP health check
+  ansible.builtin.uri:
+    url: >-
+      {{ cloudfall_deploy_component.healthCheck.scheme }}://127.0.0.1:{{
+        cloudfall_deploy_component.healthCheck.port
+      }}{{ cloudfall_deploy_component.healthCheck.path }}
+    status_code: >-
+      {{ cloudfall_deploy_component.healthCheck.expectedStatuses }}
+    timeout: "{{ cloudfall_deploy_component.healthCheck.timeoutSeconds }}"
+    return_content: false
+  register: cloudfall_deploy_gate
+  retries: >-
+    {{ cloudfall_deploy_component.healthCheck.attempts | int - 1 }}
+  delay: 3
+  until: >-
+    cloudfall_deploy_gate.status
+    in cloudfall_deploy_component.healthCheck.expectedStatuses
+  when:
+    - not ansible_check_mode
+    - cloudfall_deploy_component.healthCheck.type == "http"
+
+- name: Gate the component on an active service unit
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/systemctl
+      - is-active
+      - --quiet
+      - "{{ cloudfall_deploy_component.service.name }}.service"
+  register: cloudfall_deploy_unit_gate
+  changed_when: false
+  retries: 4
+  delay: 3
+  until: cloudfall_deploy_unit_gate.rc == 0
+  when:
+    - not ansible_check_mode
+    - cloudfall_deploy_component.healthCheck.type == "none"